IXIA IxWLAN, Руководство пользователя

Страница: 15 / 150

IxWLAN User Guide, Release 6.20 1-7
Introduction
WPA/RSN
802.1X EAPOL-Key packets are used by WPA and RSN to negotiate and derive
pairwise keys used to protect unicast traffic. Group key handshake is used to
deliver the group key to each virtual station for protecting multicast and broad-
cast class 3 data frames.
• Data Privacy (Encryption) – TKIP or AES-CCM (that is, CCMP) is used to
replace WEP with more sophisticated cryptographic and security techniques.
• Data integrity – TKIP adds a MIC at the end of each plain-text message
(MSDU) to ensure that the messages are not being spoofed or replayed. With
AES-CCM, the MIC is added to each transmitted MPDU.
EAP Algorithms
Virtual stations that are configured for WPA or RSN authentication can be con-
figured to use the TLS, TTLS, or PEAP EAP algorithms. For TLS, a certificate
file and user ID must be specified. The certificate file and user ID are optional for
TTLS and PEAP. Additional parameters that may be configured for TTLS and
PEAP include: inner algorithm, outer identify, and password. For TTLS and
PEAP, authentication proceeds in two stages: Phase 1 (outer) and Phase 2 (inner).
The outer identity is used in Phase 1 authentication. The password and inner
algorithm are used in Phase 2 authentication. The inner algorithm is normally
MS-CHAPv2 for TTLS and EAP-MS-CHAPv2 for PEAP.
Certificate Files
When using full WPA or RSN (802.1X), valid certificates must be imported into
IxWLAN using either the CLI
import command or the Available Certificates
dialog in the web-based user interface.
Key Hierarchy and
Configuration
WPA and RSN use a PMK that is used in derivation of transient keys for encryp-
tion and HMAC functions. The IxWLAN WPA/RSN feature supports two core
key hierarchies that are defined by the standard:
• Pairwise key hierarchy – The pairwise keys used to protect unicast traffic.
PTK derived from the PMK.
• Group key hierarchy – To protect multicast traffic. GTK derived from the
GMK.
For full WPA or RSN mode, the PMK is negotiated between the vSTA and an
authentication server in a sequence of EAPOL exchanges through the System
Under Test. For WPA-PSK or RSN-PSK mode, the PSK (if defined) is used as
the PMK. The PSK is manually configured in the vSTA and the System Under
Test.
IxWLAN 5.0 Limitation – The WPA Specification needs a PSK for each SSID.
IxWLAN now supports a single (global) SSID.
• IxWLAN supports a PSK per vSTA.
• The PSK can be defined using hex notation (64 hex digits) or an ASCII pass-
phrase. The ASCII passphrase is converted to a valid 256 bit key.
NOTE: IxWLAN imports only certificate files that are in the PKCS#12 format
and have been exported with their private key, without strong private key
encryption.